Back to Database
Status published
Medium
CVE-2011-1024
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a...
Vulnerability Description
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2011-1024
Credits & Attribution
No credits recorded in the NVD database.
References
- http://security.gentoo.org/glsa/glsa-201406-36.xml
- http://www.redhat.com/support/errata/RHSA-2011-0346.html
- http://securitytracker.com/id?1025188
- http://secunia.com/advisories/43708
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6607
- http://www.openldap.org/lists/openldap-technical/201004/msg00247.html
- http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/back-ldap/chain.c.diff?r1=1.76&r2=1.77&hideattic=1&sortbydate=0
- http://www.openldap.org/lists/openldap-announce/201102/msg00000.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:056
- https://bugzilla.novell.com/show_bug.cgi?id=674985
- http://openwall.com/lists/oss-security/2011/02/25/13
- http://www.redhat.com/support/errata/RHSA-2011-0347.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:055
- http://secunia.com/advisories/43718
- https://bugzilla.redhat.com/show_bug.cgi?id=680466
- http://openwall.com/lists/oss-security/2011/02/24/12
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- http://www.ubuntu.com/usn/USN-1100-1
- http://www.vupen.com/english/advisories/2011/0665
- http://secunia.com/advisories/43331
More from openldap
View All →CVE-2022-29155
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a...
Critical
9.8
CVE-2021-27212
In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion...
High
7.5
CVE-2020-36230
A flaw was discovered in OpenLDAP before 2.4.57 leading in...
High
7.5
CVE-2020-36229
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57...
High
7.5
CVE-2020-36228
An integer underflow was discovered in OpenLDAP before 2.4.57 leading...
High
7.5
Affected Vendor
openldap
View all reports →Affected Software
openldap
Vulnerable Versions:
2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23
Timeline
Official Publish:
March 20th, 2011
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.